用于出站 SMTP 数据包捕获的最佳操作系统应用程序？
好吧，这可能听起来非常邪恶，但我的高级项目需要这样的功能。 本质上，我的任务是编写一些东西，通过数据包拦截和评估系统来减少僵尸电脑上的出站垃圾邮件。 我们对捕获的消息使用了多种算法，但真正的捕获——完全拦截而不是仅仅嗅探——让我有点困惑。
该应用程序是为 Windows 设计的，因此我无法使用 IP 表。 我可以使用 winpcap 库，但如果不需要，我不想重新发明轮子。 Ettercap 似乎是一个不错的选择，但使用非官方二进制文件在 vista 上进行测试运行时除了崩溃之外什么也没得到。
那么，有什么建议吗？
更新：很好的建议。 最终缩小了项目规模，但仍然获得了 A。我认为 Adam Mintz 的答案可能是最好的，尽管我们在应用程序中使用了 WinPcap 和 Wireshark。
Okay, so this probably sounds terribly nefarious, but I need such capabilities for my senior project. Essentially I'm tasked with writing something that will cut down outbound spam on a zombified pc through a system of packet interception and evaluation. We have a number of algorithms we'll use on the captured messages, but it's the actual capture -- full on interception rather than just sniffing -- that has me a bit stumped.
The app is being designed for windows, so I can't use IP tables. I could use the winpcap libraries, but I don't want to reinvent the wheel if I don't have to. Ettercap seemed a good option, but a test run on vista using the unofficial binaries resulted in nothing but crashes.
So, any suggestions?
Update: Great suggestions. Ended up scaling back the project a bit, but still received an A. I'm thinking Adam Mintz's answer is probably best, though we used WinPcap and Wireshark for the application.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
如果这是一个长期的事情，请使用精简版的 Snort。 它旨在监视飞过的特定数据包、在需要时检查有效负载、记录数据并启动警报。
它的目的是用于入侵检测，但在长期使用中，它对于特定事物来说是一个非常好的网络监视器。
Use Snort, stripped down, if this is a long-term thing. It's built to watch for particular packets flying by, examining payload where needed, recording data and launching alerts.
It's intended for intrusion detection, but it makes a surprisingly good network monitor for particular things over long term use.
tcpdump 如果您需要命令行或更直观的东西，例如 wireshark
如果你想自己写一些东西，请使用 libpcap 。
tcpdump if you need command line or something more visual like wireshark
If you want to write something on your own use libpcap.
人们可能会认为 Wireshark 可以解决您的问题——安装简单，而且非常易于使用。
编辑：啊，我现在看到了拦截要求与只是嗅探..在这种情况下，仅 Wireshark 无法解决它。 可能相当于 Windows 上的 iptables 的东西。
One would think Wireshark would solve your problem -- no hassle install and pretty easy to use.
Edit: Ah, I see now the interception requirement vs. just sniffing.. in this case Wireshark alone won't cut it. Probably whatever's the equivalent of iptables on windows would.
我同意 Wireshark 可能就是您所需要的。 如果您想编写自己的过滤器应用程序并且可以使用 Vista，请查看 Windows 过滤平台。
I agree that Wireshark might be all you need. If you want to write your own filter application and can use Vista, then check out the Windows Filtering Platform.
DSNIFF 软件包具有 mailsnarf 实用程序。 它也可以抓取POP3。 那里还有各种其他精彩的嗅探实用程序。 使用这些工具之前请确保您拥有合法权利（拦截他人流量的合法权利）。 我相信该文档包含有关合法性的更多信息。 根据网页，也有 Windows 和 Mac OS X 端口。
分析程序的文本输出并不会太难。
The DSNIFF package has the mailsnarf utility. It can grab POP3 too. There are all sorts of other wonderful sniffing utilities there. Make sure you have the legal right before using these tools (the legal right to intercept other peoples traffic). I beleive the documentation has more information on the legality. According to the web page there are Windows and Mac OS X ports too.
It would not be too hard to analyze the text output of the program.
谢谢，CDV。 我也会调查一下。 关于合法性检查的好电话。 实际上到目前为止我一直在尝试使用 gnu 公共许可证项目。
Thanks, CDV. I'll look into that as well. Good call about the legality check. I've actually been trying to use gnu public license projects so far.
Ilkka：我正在研究 Wireshark，但据我所知，它不处理拦截方面的问题——只处理嗅探和日志记录。 教授正在寻找的是防止垃圾邮件进入网络。
Adam：我一定会研究 Winsock。 我还没有检查过。 唯一的问题是该应用程序将在大约 2 个月内到期，因此如果有任何基于 WinSock SPI 构建的操作系统应用程序，我可能想加入其中。 您知道吗？
Ilkka: I was looking at Wireshark, but from what I could tell, that didn't handle the interception aspect -- only the sniffing and logging. The thing the professor's looking for is to prevent the spams from getting out onto the network.
Adam: I'll definitely look into Winsock. I haven't checked that out yet. Only thing is the app's due in about 2 months, so if there are any OS apps that build off the WinSock SPI, I might want to tie into those. Know of any off the top of your head?
听起来您需要编写一个 Winsock LSP。
Sounds like you need to write a Winsock LSP.